Live › vulnerability › CVE-2026-63418
Monitoring Plugins' check_icmp stores its host count in an unsigned short, so more than 65,535 hosts wrap the counter and cause out-of-bounds writes. On setuid-root installs a local low-privileged user can corrupt heap memory while still running as root, though reliable escalation has not been demonstrated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 18:22 UTC. All times on this page are UTC.
Only installations from 3.0.0-rc1 through 3.0.1 where check_icmp is setuid root are exposed to the privilege-escalation consequence. Installations using cap_net_raw file capabilities instead of setuid are not exposed to that consequence. Teams that run check_icmp only with the default non-setuid setup can skip the escalation concern.
No product ranges from the sources yet.
check_icmp --version or look at the installed Monitoring Plugins version.ls -l $(which check_icmp).getcap $(which check_icmp).3.0.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-63418")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.